Anomaly detection in a wireless communication system

Abstract

A node of the wireless communication network receives data indicative of a measured QoS, level of data traffic assigned to different configured traffic forwarding policies each defining one or more target parameters. Based on the data and the target parameters, the node detects violations of the traffic forwarding policies. Based on the detected violations for each the traffic forwarding policies, the node detects at least one anomaly in the wireless communication network.

The invention claimed is: 
     
         1 . A method of controlling user data traffic in a wireless communication network, the method comprising:
 a node of the wireless communication network receiving data indicative of a measured Quality of Service (QOS) level of data traffic assigned to different configured traffic forwarding policies each defining one or more target parameters;   based on the data and the target parameters, the node detecting violations of the traffic forwarding policies; and   based on the detected violations for each of the traffic forwarding policies, the node detecting at least one anomaly in the wireless communication network, wherein detecting the at least one anomaly includes, for each traffic forwarding policy, determining a ratio of data records corresponding to the detected violations to a total number of data records for that traffic forwarding policy.   
     
     
         2 . The method according to  claim 1 , comprising:
 based on the detected violations for each of the traffic forwarding policies, the node classifying the detected at least one anomaly as corresponding to at least one of a congestion in the wireless communication network and a misconfiguration of one or more of the traffic forwarding policies.   
     
     
         3 . The method according to  claim 2 , comprising:
 wherein the data comprise a number of data records and said classifying of the detected at least one anomaly comprises:   based on the ratios, classifying the detected at least one anomaly as corresponding to at least one of a congestion in the wireless communication network and a misconfiguration of one or more of the traffic forwarding policies.   
     
     
         4 . The method according to  claim 3 ,
 wherein said classifying of the detected at least one anomaly comprises:   comparing the ratios to at least one threshold, and   based on the comparison, classifying the detected at least one anomaly as corresponding to at least one of a congestion in the wireless communication network and a misconfiguration of the traffic forwarding policy.   
     
     
         5 . The method according to  claim 4 , comprising:
 in response to the ratio being above a first threshold for a first subset of two or more of the traffic forwarding policies, classifying the anomaly as corresponding to a congestion.   
     
     
         6 . The method according to  claim 5 ,
 in response to the ratio being above the first threshold for the first subset of the traffic forwarding policies and the ratio being below a second threshold for a second subset of one or more of the traffic forwarding policies, with the one or more traffic forwarding policies of the second subset being associated with a higher traffic priority than the traffic forwarding policies of the first subset, classifying the at least one anomaly as corresponding to a congestion.   
     
     
         7 . The method according to  claim 4 ,
 in response to the ratio being above a third threshold for a third subset of one or more of the traffic forwarding policies and the ratio being below a fourth threshold for a fourth subset of one or more of the traffic forwarding policies, with the one or more traffic forwarding policies of the fourth subset being associated with a higher traffic priority than the one or more traffic forwarding policies of the third subset, classifying the anomaly as corresponding to a misconfiguration of one or more of the traffic forwarding policies of the third subset.   
     
     
         8 . The method according to  claim 3 , comprising:
 in response to classifying the anomaly as corresponding to a misconfiguration, reassigning at least a part of the data traffic to one or more traffic forwarding policies associated with a higher priority.   
     
     
         9 . The method according to  claim 3 , comprising:
 based on the ratios for each of the traffic forwarding policies, the node determining a rate of violations per network location and per traffic forwarding policy.   
     
     
         10 . The method according to  claim 1 , comprising:
 based on the detected at least one anomaly, the node determining a number of anomalies per network location.   
     
     
         11 . The method according to  claim 9 , comprising:
 based on the rate of violations and/or the number of violations, the node determining a score for prioritizing among capacity increase measures at different network locations.   
     
     
         12 . The method according to  claim 1 ,
 wherein the target parameters comprise a target delay defined for each of the traffic forwarding policies.   
     
     
         13 . The method according to  claim 12 , wherein detecting the at least one anomaly comprises detecting a first type of anomalies based on violations of only the target delays. 
     
     
         14 . The method according to  claim 1 ,
 wherein the target parameters comprise a target packet error rate defined for each of the traffic forwarding policies.   
     
     
         15 . The method according to  claim 14 ,
 wherein detecting the at least one anomaly comprises detecting a second type of anomalies based on violations of only the target packet error rates.   
     
     
         16 . The method according to  claim 1 ,
 based on the detected at least one anomaly, reconfiguring at least some of the traffic forwarding policies.   
     
     
         17 . The method according to  claim 1 , comprising:
 based on the detected at least one anomaly, configuring at least one new traffic forwarding policy.   
     
     
         18 . The method according to  claim 1 , comprising:
 the node receiving the data from one or more further nodes of the wireless communication network.   
     
     
         19 . The method according to  claim 18 ,
 wherein the one or more further nodes comprise at least one node of an access network part of the wireless communication network.   
     
     
         20 . The method according to  claim 18 ,
 wherein the one or more further nodes comprise at least one node of a core network part of the wireless communication network.